Training attestation

Atlas

A formal confirmation that a named person has been trained on a named policy, which an auditor can ask for.

What is a training attestation?

A training attestation is a formal confirmation that a named person has been trained on a named policy at a stated revision. It is made by the individual and retained with a timestamp, as evidence an auditor can request directly. Completion of a module and an attestation are different records, since one reports activity where the other is a declaration.

Also called: Policy attestation

Why responsibility moves to the individual at this point

An auditor does not ask whether training was delivered. The question is whether a specific person, named in a specific role, confirmed that they had read and understood a specific version of a policy, and the answer is either a dated record or an excuse. Attestation is the point at which responsibility moves to the individual, which is precisely why the wording has to be careful and the capture clean. An attestation to a document superseded the same week is worse than none, because it demonstrates that the control is theatre.

  • Attestation transfers responsibility for knowing the policy onto the named individual.
  • An auditor can request one record for one person and expects it immediately.
  • The wording of the declaration determines what the record actually proves.
  • Attestations pinned to a revision make a policy change auditable across a population.

How a training attestation works

  • The declaration wording is agreed with the control owner and with legal review.
  • The policy revision being attested to is displayed at the moment of signing.
  • Identity is established through the enterprise directory rather than through a typed name.
  • The attestation is stored with its timestamp and the revision identifier.
  • Outstanding attestations are escalated through the line while the obligation stands.
  • Records are retained for the period over which the obligation can be examined.

How a training attestation is evaluated

An attestation is assessed on whether one record for one person can be produced and defended. Test the following against the live population:

  • share of the population with a current attestation per policy
  • time to retrieve a single person's attestation history
  • proportion of attestations carrying a resolvable revision identifier
  • interval between policy approval and full attestation coverage
  • count of attestations against a superseded revision

Limitations, risks and common failure modes

  • People attest to having read a document the interface never actually showed them.
  • Declaration wording claims understanding where the evidence supports only acknowledgement.
  • Attestations are collected annually while the policy is revised quarterly.
  • The record names a login rather than a person, which a leaver's account then confuses.

Related terms

MicrolearningTraining delivered in short units that a person can complete between other work rather than in a scheduled block.Trainer dependencyThe constraint created when delivery requires a scheduled person, which limits how fast a network can be reached.Training coverageThe share of a population trained on the current version of a given policy at a given date.Completion recordThe record of who completed which module, on which version of the source, and when.Append-only logA record that can be added to and never amended, which is what makes a history worth presenting.Content freshnessHow recently training content was regenerated against its source, and how far it has drifted since.

All 315 terms